Comment by JimDabell
21 days ago
They trialled this in Singapore and I’ve been telling people on Hacker News that it’s been going to happen for a while:
> Singapore Android users to be blocked from installing certain unverified apps as part of anti-scam trial (07 Feb 2024)
— > As I’ve mentioned here before, sideloading is a genuine security concern, not merely an excuse for Apple to exert control. There is a never-ending stream of people losing their life savings. It happens on Android and not iOS because Android allows sideloading and iOS doesn’t. There is a very real human cost to this. > Police warn new Android malware scam can factory reset phones; over S$10 million lost in first half of 2023 > There have been more than 750 cases of victims downloading the malware into their phones in the first half of 2023, with losses of at least S$10 million (US$7.3 million). — https://www.channelnewsasia.com/singapore/android-malware-sc... > DBS, UOB become latest banks to restrict access if unverified apps are found on customers' phones > They are the latest banks in Singapore to do so – after OCBC and Citibank – amid a spate of malware scams targeting users of Android devices. — https://www.channelnewsasia.com/singapore/dbs-uob-anti-scam-... > 74-year-old man loses $70k after downloading third-party app to buy Peking duck > “I couldn’t believe the news. I thought: Why am I so stupid? I was so angry at myself for being cheated of my life savings. My family is frustrated and I ended up quarrelling with my wife,” said Mr Loh, who has three children. — https://www.straitstimes.com/singapore/74-year-old-man-loses... > Singapore Android users to be blocked from installing certain unverified apps as part of anti-scam trial > "Based on our analysis of major fraud malware families that exploit these sensitive runtime permissions, we found that over 95 per cent of installations came from internet-sideloading sources," it added. — https://www.channelnewsasia.com/business/anduril-secures-305... > CNA Explains: Are Android devices more prone to malware and how do you protect yourself from scams? > Why are scammers more likely to target Android users? How do you spot a fake app and what should you do if your device is infected by malware? — https://www.channelnewsasia.com/singapore/android-malware-sc... > Nearly 2,000 victims fell for Android malware scams, at least S$34.1 million lost in 2023 > In 2023, about 1,899 cases of Android malware scams were reported in Singapore. The average amount lost was about S$17,960. — https://www.channelnewsasia.com/singapore/android-malware-sc... > Android users in Singapore tried to install unverified apps nearly 900,000 times in past 6 months > These attempts were blocked by a security feature rolled out by Google six months ago as part of a trial to better protect users against malware scams, which led to at least S$34.1 million (US$25.8 million) in losses last year with about 1,900 cases reported.
Malware exists, but you are only focusing on the benefit of removing user freedoms. Can you provide a similar analysis of the costs, or do you just ignore them because they are hard to reason about?
F-Droid is a massive win for the mobile ecosystem, probably the last bastion of useful free software for mobile devices. Being able to build an APK at home and run it on my phone is the ideal way computers should be used. But you can't put a price on these freedoms.
You're advocating for a system that removes the least abusive app store so we can hand more control to the most abusive app store. I can't support that, especially when it's glaringly obvious that walled app store are neither necessary nor sufficient to provide safety for users.
I think your comment highlights the balancing act of providing an open platform while also protecting the average user. I'm sure everyone here knows that the average technology user is not the brightest or savvy. Making changes like putting scare screens before side loading an app is a good compromise on the user side. However it does make it more difficult for app developers to distribute their apps that way. Anyone with basic security training will be cautious about going further. So you've effectively limited your audience just to power users.
However moving to a whitelist system I think is counterproductive. Especially when Google is the only one with the power to edit that list. There is a reason Microsoft or Apple never went down this route in the name of security. It's just too much of a burden on them and it hinders power users, hobbyists, and small developers. Cases where one might want to keep their identity to themselves are edge cases but they are VERY important edge cases.
I know the situation in Singapore and Thailand and I was curious if there would be anyone mentioning it in this discussion. Thank you for your comment, you should be upvoted.
All of those links 404s for me. Can you explain how the malware works? You are aware that it's not the app store that protects you, but the sandboxing? Are these impersonation vectors, ie phishing?
Oh, thanks for pointing that out. I copied and pasted from my previous comment here:
https://news.ycombinator.com/item?id=44194034
I didn’t notice that Hacker News had truncated the URLs for display. You can get to the articles by following the links in the original comment.
> You are aware that it's not the app store that protects you, but the sandboxing?
Both protect you.
> Are these impersonation vectors, ie phishing?
It’s a variety of things. Some use accessibility hooks to act as key loggers. Some seem to use exploits. Some are phishing by impersonating other apps.
When governments across the globe are becoming more authoritarian, we need to protect our ability to run whatever app we want. Otherwise they'll ban communication apps when we step out of line and protest, as we've seen in places like Hong Kong on more locked down platforms like iOS. This isn't about power users. It doesn't matter how many links you post. The US is literally turning into an authoritarian dictatorship before our eyes. Germany's AfD now commands 25% of the vote and it keeps increasing. Far right parties are gaining ground everywhere.
We can't be handwringing about safety right now, because our right to free speech and to protest are at stake. Our democracies are at stake here.
The vast, vast majority of android malware that's used is on the Google play store. Because that's where the vast, vast majority of apps are from.
This is a completely made up and hallucinated problem. I will not mince words - this is a blatant attempt at deception.
We do not need to block sideloading to:
1. Stop malicious apps (does nothing)
2. Stop users from side loading
If we want to stop sideloading, we can simply introduce an arduous process to enable side loading. For example - consider turning on ADB. Do we vaporize ADB? No, because that's fucking stupid.
But now when it comes to apps, that little nugget of information is suddenly conveniently not considered.